I'm working on a plugin that needs to encrypt some user data. I'm setting an encryption key for SecurityService, but am trying to decide where to store that encryption key so it can be used on subsequent requests to decrypt the data. A few options are coming to mind:
StatePersister: this is where Craft keeps its cookie validation key, but is likely to be ignored by .gitignore, so probably wouldn't be persistent for long.
Plugin Settings Table: this is the approach being used by the SecureField Plugin. It's very straightforward, but also minimally secure as pretty much any SQL injection attack would compromise the key and its encrypted data. The upside is that the key's persistence is practically guaranteed.
Extend CStatePersister: This could be used to persist state in a writable location of my plugin's folder. It's more likely that this would be preserved in version control, but not very likely that the location will be writable on a production server.
As it stands, storing the key in the database is the most likely to work on a wide variety of servers, but probably has the poorest level of security. Am I missing any other options?